Progress MoveIt Transfer — Vulnerability Disclosure
Atumcell-discovered weakness in Progress Software's MoveIt Transfer file-transfer product, coordinated with the vendor and publicly disclosed.
Affected
Progress Software (MoveIt Transfer)
Severity
High
Published
1 January 2024
Summary
Atumcell research surfaced a security weakness in Progress Software's MoveIt Transfer product. The disclosure was coordinated with the vendor and reported in the trade press alongside related findings in Zoho Desk, illustrating the recurring exposure pattern in widely deployed enterprise file-transfer and ITSM software.
Detail
MoveIt Transfer is a managed file-transfer product widely deployed in regulated sectors — financial services, healthcare, government supply chain — where the file-transfer layer is treated as transport plumbing and rarely receives security attention proportional to the data it moves. The combination of broad deployment and underweighted assurance makes it a recurring high-impact target.
The finding was disclosed to Progress Software through their coordinated disclosure process. Channel Futures covered the disclosure in December 2024 alongside a related Zoho Desk finding. The practical implication for operators is the same one that drove the broader 2023 MoveIt incidents into national headlines: file-transfer infrastructure is part of the perimeter, not adjacent to it, and assessments of "sensitive data exposure" that omit transfer layers will continue to miss material exposure paths.
References
Research · Disclosure · Collaboration
Working on a security problem worth investigating?
Start a conversationMore on these topics
Other research
Disclosure
Zoho Desk — Vulnerability Disclosure
Atumcell-discovered weakness in Zoho's Desk help-desk product, disclosed to the vendor and reported alongside the MoveIt Transfer finding.
Research
N-able Workgroup Guideline — Security Risk to MSPs
Research finding that N-able's published workgroup guideline created a meaningful exposure for managed service providers and their downstream clients.
Research
Physically Hacking SCADA — Cyber-Physical Attack Chains
Research on cyber-physical attack chains against SCADA systems, demonstrating how digital compromises produce physical-layer effects.